@bitkyc08/opencodex 2.78.0 → 2.80.0

package/src/codex/auth-api/routes.ts

@@ -24,6 +24,7 @@ import { inspectResetCredits, consumeResetCredits } from "./reset-credit-service
 import { getRuntimeConfig, saveRuntimeConfig, configuredPoolAccount } from "./runtime-config";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import { getEffectiveCodexAutoSwitchThreshold, isCodexAccountAutoSwitchThresholdKey, parseCodexAutoSwitchThreshold, setCodexAccountAutoSwitchThresholdOverride } from "../account-auto-switch";
+import { withCodexAccountPauseGroup } from "./account-pause-group";
 
 export async function handleCodexAuthAPI(
   req: Request,
@@ -100,18 +101,23 @@ export async function handleCodexAuthAPI(
       || (runtimeConfig.codexAccounts ?? []).some(account => isSelectableCodexPoolAccount(account) && account.id === id);
     if (!exists) return jsonResponse({ error: "Account not found" }, 404);
 
-    setCodexAccountPaused(runtimeConfig, id, body.paused);
-    if (body.paused) {
-      clearThreadAccountMapForAccount(id);
-      selectFallbackAfterPause(runtimeConfig, id);
-    }
-    saveRuntimeConfig(config, runtimeConfig);
-    return jsonResponse({
-      ok: true,
-      id,
-      paused: body.paused,
-      activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
-      appliesImmediately: true,
+    const paused = body.paused;
+    return withCodexAccountPauseGroup(runtimeConfig, id, accountIds => {
+      // Publish every exclusion before reconciling: a duplicate must never become the fallback.
+      for (const accountId of accountIds) setCodexAccountPaused(runtimeConfig, accountId, paused);
+      if (paused) {
+        for (const accountId of accountIds) clearThreadAccountMapForAccount(accountId);
+        for (const accountId of accountIds) selectFallbackAfterPause(runtimeConfig, accountId);
+      }
+      saveRuntimeConfig(config, runtimeConfig);
+      return jsonResponse({
+        ok: true,
+        id,
+        paused,
+        affectedAccountIds: accountIds,
+        activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+        appliesImmediately: true,
+      });
     });
   }
 

package/src/codex/auth-context.ts

@@ -1,3 +1,4 @@
+import { bindPoolCreditPolicy, poolCreditHoldResetAt, poolContextCreditHoldResetAt } from "./pool-credit-policy";
 import { hasSpendableCodexCredits } from "./quota-types";
 import { noteMainAccountActivity } from "./main-account-external-usage";
 import { codexAccountPriorityFailbackEnabled } from "./account-priority";
@@ -525,6 +526,23 @@ export class CodexMainAccountHardLockError extends CodexAccountCooldownError {
   }
 }
 
+/** A stored pool account's spending policy is independent of account selection. */
+export class CodexPoolAccountCreditsOffError extends CodexAccountCooldownError {
+  readonly resetAt: number;
+
+  constructor(accountId: string, resetAt: number) {
+    super(accountId, resetAt);
+    this.name = "CodexPoolAccountCreditsOffError";
+    this.resetAt = resetAt;
+    this.message = "The selected Codex account reached its usage limit, and spending credits is off or no fresh spendable balance is available."
+      + " Wait for the limit to reset, choose another account, or explicitly allow credits for this account in Codex Auth.";
+  }
+}
+
+function assertPoolAccountCredits(accountId: string, resetAt: number | undefined): void {
+  if (resetAt !== undefined) throw new CodexPoolAccountCreditsOffError(accountId, resetAt);
+}
+
 /** The main login may not spend credits and one of its usage windows is full (#6334). */
 export class CodexMainAccountCreditsOffError extends CodexAccountCooldownError {
   readonly resetAt?: number;
@@ -597,7 +615,7 @@ export class CodexRecoveryWithheldError extends CodexAccountCooldownError {
 
 export type CodexAuthPolicyConfig = Readonly<Pick<OcxConfig,
   "codexMainAccountHardLock" | "codexMainAccountHardLockThresholds" | "codexDesktopAuthless" | "runtimeRole" | "pausedCodexAccountIds"
-  | "creditCodexAccountIds"
+  | "creditCodexAccountIds" | "codexAccounts"
 >>;
 
 interface CodexAuthMaterializationOptions {
@@ -725,6 +743,22 @@ export function unwrapUpstreamRetryEvidenceError(error: unknown): unknown {
  * Same evidence the hard lock reads, and no plan lookup: the plan can live in the physical auth
  * file, which several callers are forbidden to open, so every long window counts instead.
  */
+/** Recheck live account policy at the physical send, after pacing or retry backoff. */
+export function createCodexAuthDispatchGuard(
+  ctx: CodexAuthContext,
+  config: CodexAuthPolicyConfig,
+  modelId: string,
+  admission?: Pick<DataPlaneAdmission, "source">,
+  terminalHelper = false,
+): ((headers: Headers) => void) | undefined {
+  const reserveGuard = createCodexReserveDispatchGuard(ctx, config, modelId, admission, terminalHelper);
+  if (ctx.kind !== "pool") return reserveGuard;
+  return headers => {
+    assertPoolAccountCredits(ctx.accountId, poolContextCreditHoldResetAt(ctx, config));
+    reserveGuard?.(headers);
+  };
+}
+
 function mainCreditsHoldResetAt(config: Pick<OcxConfig, "creditCodexAccountIds">): number | undefined {
   if (codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID)
     && hasSpendableCodexCredits(getMainPolicyQuota())) return undefined;
@@ -868,6 +902,7 @@ export function cooldownErrorMessage(err: CodexAccountCooldownError, accountSele
     // A credits-off refusal is a configuration policy, not a cooldown: clearing a cooldown
     // cannot lift it, so its own wording (wait for the reset or allow credits) is the remedy.
     || err instanceof CodexMainAccountCreditsOffError
+    || err instanceof CodexPoolAccountCreditsOffError
     || err instanceof CodexReserveUnavailableError
     // A transient-hold refusal is not a quota cooldown. Its own wording is the only accurate
     // one, and the quota recovery advice below would send the operator after a cooldown that
@@ -917,6 +952,7 @@ export class CodexThreadAffinityExpiredError extends Error {
 export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown): boolean {
   return !(cause instanceof CodexMainAccountHardLockError)
     && !(cause instanceof CodexMainAccountCreditsOffError)
+    && !(cause instanceof CodexPoolAccountCreditsOffError)
     && !(cause instanceof CodexAccountValidationPendingError)
     && !(cause instanceof CodexReserveUnavailableError)
     && !(cause instanceof CodexCredentialGenerationConflictError)
@@ -1408,6 +1444,7 @@ export async function resolveCodexAuthContext(
   // deferred credential must never become request auth through that fallback.
   try {
     assertCodexAccountValidationReady(accountId);
+    assertPoolAccountCredits(accountId, poolCreditHoldResetAt(policy, accountId, config));
   } catch (cause) {
     // Nothing will reach upstream, so give the trial back instead of leaving the held account
     // unprobeable until the lease deadline lapses (#4701).
@@ -1533,7 +1570,8 @@ export async function resolveCodexAuthContext(
   try {
     const token = await getValidCodexToken(accountId, { signal: options.signal });
     assertCodexAccountValidationReady(accountId);
-    return {
+    assertPoolAccountCredits(accountId, poolCreditHoldResetAt(policy, accountId, config));
+    return bindPoolCreditPolicy({
       kind: "pool",
       accountId,
       writerGeneration,
@@ -1548,11 +1586,12 @@ export async function resolveCodexAuthContext(
       ...(probeQuotaScope ? { probeQuotaScope } : {}),
       ...(affinityDecision ? { affinityDecision } : {}),
       ...(transientProbe ? { transientProbe } : {}),
-    };
+    }, config, policy);
   } catch (cause) {
     releaseTransientProbeGrant();
     if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
     else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
+    if (cause instanceof CodexPoolAccountCreditsOffError) throw cause;
     if (!options.signal?.aborted && shouldMarkAccountNeedsReauthForCodexAuthFailure(cause)) {
       markAccountNeedsReauth(accountId, writerGeneration);
     }
@@ -1562,6 +1601,7 @@ export async function resolveCodexAuthContext(
 
 export function assertCodexAuthContextNotCooled(ctx: CodexAuthContext | undefined): void {
   if (ctx?.kind !== "pool" && ctx?.kind !== "main-pool") return;
+  if (ctx.kind === "pool") assertPoolAccountCredits(ctx.accountId, poolContextCreditHoldResetAt(ctx));
   // A context holding the probe lease was deliberately admitted through the cooldown.
   if (ctx.probeLeaseId) return;
   const cooldown = getCodexQuotaHealthSnapshot(ctx.accountId, ctx.quotaScope);
@@ -1577,6 +1617,7 @@ export function applyCodexAuthContextToProvider(
 ): OcxRuntimeProviderConfig {
   if (mode !== "pool" || (ctx.kind !== "pool" && ctx.kind !== "main-pool") || provider.authMode !== "forward") return provider;
   assertCodexAccountValidationReady(ctx.accountId);
+  if (ctx.kind === "pool") assertPoolAccountCredits(ctx.accountId, poolContextCreditHoldResetAt(ctx));
   return {
     ...provider,
     _codexAccountOverride: {
@@ -1620,6 +1661,7 @@ export function materializeCodexUpstreamAuth(
   }
   if (ctx.kind === "pool" || ctx.kind === "main-pool") {
     assertCodexAccountValidationReady(ctx.accountId);
+    if (ctx.kind === "pool") assertPoolAccountCredits(ctx.accountId, poolContextCreditHoldResetAt(ctx, options.config));
     selected.set("authorization", `Bearer ${ctx.accessToken}`);
     selected.set("chatgpt-account-id", ctx.chatgptAccountId);
     if (ctx.kind === "main-pool") {

package/src/codex/autostart-health.ts

@@ -4,12 +4,22 @@ import type { OcxConfig } from "../types";
 import { getCodexRoutingKind, type CodexRoutingKind } from "./inject";
 import { collectRoutingAdoption, type RoutingAdoptionEvidence } from "./routing-adoption";
 import { diagnoseCodexShim, type CodexShimDiagnostic } from "./shim";
-import { diagnoseMacDesktopStartup, type DesktopStartupDiagnostic } from "../service/desktop-startup";
+import { diagnoseDesktopStartup, type DesktopStartupDiagnostic } from "../service/desktop-startup";
 
 export type StartupProtection = "service" | "desktop" | "shim" | "none";
 export type StartupHealthStatus = "native" | "protected" | "at-risk";
 export type ShimCoverage = "full" | "cli-only" | "none";
 
+/** Bound the isolated service-manager probe and let its reader outlive that probe. */
+export function startupHealthProbeBudgetMs(platform: NodeJS.Platform = process.platform): number {
+  return platform === "win32" ? 15_000 : 5_000;
+}
+
+export function startupHealthReadBudgetMs(platform: NodeJS.Platform = process.platform): number {
+  // The endpoint waits an extra 500ms for child settlement; reserve another second for HTTP.
+  return startupHealthProbeBudgetMs(platform) + 1_500;
+}
+
 export interface StartupHealthInputs {
   desktop?: DesktopStartupDiagnostic;
   routingKind: CodexRoutingKind;
@@ -80,7 +90,7 @@ export function deriveStartupHealth(inputs: StartupHealthInputs): StartupHealth
   // We can only credit an opencodex service/shim for routing that opencodex owns.
   // An arbitrary localhost gateway has an independent lifecycle that OCX cannot repair.
   const ownsLocalRouting = inputs.routingKind === "opencodex-local";
-  const desktopEffective = inputs.platform === "darwin" && !inputs.diagnosticStale
+  const desktopEffective = (inputs.platform === "darwin" || inputs.platform === "linux") && !inputs.diagnosticStale
     && inputs.desktop?.owned === true && inputs.desktop.loginEnabled
     && inputs.desktop.running && inputs.desktop.viable;
   const protection: StartupProtection = ownsLocalRouting && inputs.serviceViable
@@ -137,7 +147,7 @@ export function collectStartupHealth(
   const shim = diagnostics.shim ?? diagnoseCodexShim();
   const service = diagnostics.service ?? diagnoseService();
   const routingKind = diagnostics.routingKind ?? getCodexRoutingKind();
-  const desktop = diagnostics.desktop ?? diagnoseMacDesktopStartup();
+  const desktop = diagnostics.desktop ?? diagnoseDesktopStartup();
   const routingAdoption = diagnostics.routingAdoption
     ?? (routingKind === "opencodex-local" ? collectRoutingAdoption({ routingKind }) : undefined);
   return deriveStartupHealth({

package/src/codex/journal.ts

@@ -85,6 +85,9 @@ export interface RestoreJournalResult {
   ownershipRefusal?: CodexHomeOwnerRefusalReason;
   configRestored: boolean;
   profileRestored: boolean;
+  /** True only when restore rewrote or removed a file (not when state was already original). */
+  configRewritten: boolean;
+  profileRewritten: boolean;
   configChanged: boolean;
   profileChanged: boolean;
   complete: boolean;
@@ -299,12 +302,13 @@ export function restoreJournalState(): RestoreJournalResult {
   try { assertCodexHomeOwner(CODEX_HOME); }
   catch (error) {
     if (!(error instanceof CodexHomeOwnerRefusal)) throw error;
-    return { configRestored: false, profileRestored: false, configChanged: false, profileChanged: false,
-      complete: false, unverified: true, ownershipRefusal: error.reason };
+    return { configRestored: false, profileRestored: false, configRewritten: false, profileRewritten: false,
+      configChanged: false, profileChanged: false, complete: false, unverified: true, ownershipRefusal: error.reason };
   }
   const journal = readJournal();
   if (!journal) {
-    return { configRestored: false, profileRestored: false, configChanged: false, profileChanged: false, complete: false, unverified: false };
+    return { configRestored: false, profileRestored: false, configRewritten: false, profileRewritten: false,
+      configChanged: false, profileChanged: false, complete: false, unverified: false };
   }
   const currentConfig = existsSync(CODEX_CONFIG_PATH) ? readFileSync(CODEX_CONFIG_PATH, "utf-8") : null;
   const currentProfile = existsSync(CODEX_PROFILE_PATH) ? readFileSync(CODEX_PROFILE_PATH, "utf-8") : null;
@@ -316,6 +320,8 @@ export function restoreJournalState(): RestoreJournalResult {
     return {
       configRestored: comparison.configAlreadyOriginal,
       profileRestored: comparison.profileAlreadyOriginal,
+      configRewritten: false,
+      profileRewritten: false,
       configChanged: !configUnchanged,
       profileChanged: !profileUnchanged,
       complete: false,
@@ -326,14 +332,18 @@ export function restoreJournalState(): RestoreJournalResult {
   assertCodexHomeOwner(CODEX_HOME);
   let configRestored = comparison.configAlreadyOriginal;
   let profileRestored = comparison.profileAlreadyOriginal;
+  let configRewritten = false;
+  let profileRewritten = false;
   if (configUnchanged && !configRestored) {
     atomicWriteFile(CODEX_CONFIG_PATH, comparison.originalConfig);
     configRestored = true;
+    configRewritten = true;
   }
   if (profileUnchanged && !profileRestored) {
     if (comparison.originalProfile !== null) {
       atomicWriteFile(CODEX_PROFILE_PATH, comparison.originalProfile);
       profileRestored = true;
+      profileRewritten = true;
     } else if (existsSync(CODEX_PROFILE_PATH)) {
       // "There was no profile before, so remove the one we generated." Claiming success
       // without checking is how a caller ends up deleting the journal, reporting a clean
@@ -343,6 +353,7 @@ export function restoreJournalState(): RestoreJournalResult {
       try {
         unlinkSync(CODEX_PROFILE_PATH);
         profileRestored = true;
+        profileRewritten = true;
       } catch (error) {
         profileRestored = (error as NodeJS.ErrnoException).code === "ENOENT";
       }
@@ -355,6 +366,8 @@ export function restoreJournalState(): RestoreJournalResult {
   return {
     configRestored,
     profileRestored,
+    configRewritten,
+    profileRewritten,
     configChanged: !configUnchanged,
     profileChanged: !profileUnchanged,
     complete,
@@ -367,6 +380,11 @@ export function restoreJournal(): boolean {
   return restoreJournalState().complete;
 }
 
+/** A no-rewrite recovery is quiet only when the stale journal is actually gone. */
+function warnIfJournalRetained(): void {
+  if (existsSync(JOURNAL_PATH)) console.error("⚠️ Codex journal recovery found nothing to restore, but the journal could not be removed; it will be retried on the next start.");
+}
+
 export interface ReconcileJournalOptions {
   activeClientApiKeyId?: string;
 }
@@ -388,7 +406,13 @@ export function reconcileJournal(options: ReconcileJournalOptions = {}): boolean
       console.error("⚠️ Codex journal recovery was not verified; current configuration files and the journal were preserved.");
       return false;
     }
-    if (!restored.configRestored && !restored.profileRestored) return false;
+    if (!restored.complete) {
+      console.error("⚠️ Codex journal recovery was incomplete; the journal was preserved — check the Codex files.");
+      return false;
+    }
+    // Warn only when restore actually rewrote state; an already-original
+    // snapshot still cleans itself up but has nothing to report.
+    if (!restored.configRewritten && !restored.profileRewritten) { warnIfJournalRetained(); return false; }
     console.error(`⚠️  Uncommitted or mismatched client routing (${owner.apiKeyId}) was restored from the Codex journal.`);
     return true;
   }
@@ -406,7 +430,14 @@ export function reconcileJournal(options: ReconcileJournalOptions = {}): boolean
     console.error("⚠️ Codex journal recovery was not verified; current configuration files and the journal were preserved.");
     return false;
   }
-  if (!restored.configRestored && !restored.profileRestored) return false;
+  if (!restored.complete) {
+    console.error("⚠️ Codex journal recovery was incomplete; the journal was preserved — check the Codex files.");
+    return false;
+  }
+  // Warn only when restore actually rewrote state. A stale journal whose
+  // artifacts are already original still cleans itself up (complete removes
+  // it) but has nothing to report — claiming a restore then cries wolf.
+  if (!restored.configRewritten && !restored.profileRewritten) { warnIfJournalRetained(); return false; }
   console.error(`⚠️  Previous session (PID ${pid}) did not shut down cleanly. Codex state restored from journal.`);
   return true;
 }

package/src/codex/pool-credit-policy.ts

@@ -0,0 +1,67 @@
+import type { OcxConfig } from "../types";
+import { codexUsageLimitResetAt, isCodexAccountHeldForCredits } from "./account-credit-use";
+import { MAIN_CODEX_ACCOUNT_ID } from "./main-account";
+import { isSelectableCodexPoolAccount } from "./account-id";
+import { getAccountQuota } from "./quota";
+
+export type PoolCreditPolicyConfig = Readonly<Pick<OcxConfig, "creditCodexAccountIds" | "codexAccounts">>;
+type PoolContext = { kind: "pool"; accountId: string };
+
+// Keep live policy references private: they must not enter DTOs or serialized auth context.
+const policies = new WeakMap<object, {
+  config: PoolCreditPolicyConfig;
+  policy: PoolCreditPolicyConfig;
+}>();
+
+/** Read cached usage only. This helper never opens or refreshes a credential. */
+export function poolCreditHoldResetAt(
+  policy: PoolCreditPolicyConfig,
+  accountId: string,
+  catalog: PoolCreditPolicyConfig = policy,
+  now = Date.now(),
+): number | undefined {
+  // Native main has an independent identity-bound quota policy. Never read its physical plan.
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) return undefined;
+  const quota = getAccountQuota(accountId);
+  const plan = catalog.codexAccounts
+    ?.find(account => isSelectableCodexPoolAccount(account) && account.id === accountId)?.plan;
+  if (!isCodexAccountHeldForCredits(policy, accountId, quota, plan, now)) return undefined;
+  return codexUsageLimitResetAt(quota, plan, now);
+}
+
+/** Remember policy by reference so later credential materialization rechecks current values. */
+export function bindPoolCreditPolicy<T extends PoolContext>(
+  context: T,
+  config: PoolCreditPolicyConfig,
+  policy: PoolCreditPolicyConfig = config,
+): T {
+  policies.set(context, { config, policy });
+  return context;
+}
+
+/**
+ * Carry the resolver's live policy onto a context rebuilt by spread copy. The WeakMap keys on
+ * object identity, so `{ ...ctx }` alone loses the binding and every caller that omits an
+ * explicit override would skip credit-hold enforcement on the copy. A source with no binding
+ * leaves the target unbound rather than inventing a policy.
+ */
+export function rebindPoolCreditPolicy<S extends PoolContext, T extends object>(source: S, target: T): T {
+  const bound = policies.get(source);
+  if (bound) policies.set(target, bound);
+  return target;
+}
+
+/** Explicit policy wins; omitted materialization options retain the resolver's policy. */
+export function poolContextCreditHoldResetAt(
+  context: PoolContext,
+  override?: PoolCreditPolicyConfig,
+  now = Date.now(),
+): number | undefined {
+  const bound = policies.get(context);
+  const policy = override ?? bound?.policy;
+  // Unbound contexts skip credit-hold enforcement entirely: callers that require
+  // enforcement must supply `override` (or resolve through bindPoolCreditPolicy).
+  if (!policy) return undefined;
+  const catalog = override?.codexAccounts ? override : bound?.config ?? policy;
+  return poolCreditHoldResetAt(policy, context.accountId, catalog, now);
+}

package/src/codex/shim-overlay.ts

@@ -48,11 +48,19 @@ function lexical(path: string): Stats | null {
   try { return lstatSync(path); }
   catch (error) { if (fileErrorCode(error) === "ENOENT") return null; throw error; }
 }
+/** Name the path and the failed check; a group/world-writable owned file gets the chmod that fixes it. */
+function untrustedArtifact(path: string, stat: Stats): Error {
+  const prefix = `Private Codex artifact is not an owned regular file: ${path}`;
+  if (stat.isSymbolicLink() || !stat.isFile()) return new Error(`${prefix} is not a regular file`);
+  if (stat.uid !== process.getuid?.()) return new Error(`${prefix} is owned by uid ${stat.uid}`);
+  const mode = (stat.mode & 0o777).toString(8).padStart(4, "0");
+  return new Error(`${prefix} is group- or world-writable (mode ${mode}); run chmod 600 ${shQuote(path)} and retry`);
+}
 function snapshot(path: string): Snapshot | null {
   const before = lexical(path);
   if (!before) return null;
   if (!before.isFile() || before.isSymbolicLink() || before.uid !== process.getuid?.() || (before.mode & 0o022)) {
-    throw new Error("Private Codex artifact is not an owned regular file");
+    throw untrustedArtifact(path, before);
   }
   const bounded = readBoundedRegularFile(path, PRIVATE_FILE_MAX_BYTES);
   if (!bounded || "warning" in bounded) throw new Error("Private Codex artifact is unreadable or changed");

package/src/combos/jev.ts

@@ -47,6 +47,7 @@ const TOOL_NAME_CHARS = 160;
 const VISIBLE_TEXT_CHUNK_CHARS = 16_384;
 
 const ENVELOPE_TAGS = [
+  "system-reminder",
   "codex_internal_context",
   "recommended_plugins",
   "environment_context",
@@ -302,7 +303,8 @@ function taskWithoutProtectedEnvelopes(text: string): string {
       }
     } else {
       if (stack.length === 0) appendTrimmedRange(visible, "\n", 0, 1);
-      if (!completedGoal && !goal && tag === "codex_internal_context") {
+      // A Codex goal quoted inside a Claude reminder is context, never a fallback task.
+      if (!completedGoal && !goal && tag === "codex_internal_context" && !stack.includes("system-reminder")) {
         goal = { sample: emptyTextSample(), pendingWhitespace: emptyTextSample() };
         goalDepth = stack.length;
       }